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The STS-107 crewmembers pose for their traditional in-flight crew portrait 
aboard the Space Shuttle Columbia. From the left (bottom row) are 
astronauts Kalpana Chawla, mission specialist; Rick D. Husband mission 
commander; Laurel B. Clark , mission specialist; and I Ian Ramon , payload 
specialist. From the left (top row) are astronauts David M. Brown , mission 
specialist; William C. McCool, pilot; and Michael P. Anderson , payload 
commander. Credit: NASA 
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Relevant Quotes 


Henry Pohl, former Director of JSC Engineering Directorate: "Safety is 
everyone's job." 


National Safety Reporting System (NSRS) poster: "If it's not safe, say so!" 

Columbia Debris Traveling Display-Exhibit at JSC: "Everyone that touches a 
mission , on every level, is responsible for what it represents and the lives 
that are involved." 


JSC Mission Operations Directorate, JSC Building 4 Lobby: "To always be 
aware that suddenly and unexpectedly we may find ourselves in a role 
where our performance has ultimate consequences. Vigilance." 


Background: Mission STS-107 


"On February 1 [2003], Space Shuttle Columbia was destroyed in a disaster that claimed 
the lives of all seven of its crew." [*Ref. CAIB report ] 


On launch day (Jan. 16, 2003) a large chunk of foam, weighing about 1.7 LB, broke loose 
from the External Tank bi-pod area during ascent and struck the left wing at a relative 
speed of over 500 mph. This was observed during Columbia's powered ascent by 
ground camera video and reported to Space Shuttle Program managers the day after 
launch. 


As a result, on Feb. 1, 2003, the vehicle suffered severe overheating and disintegrated 
during planned atmospheric entry. This was caused by catastrophic damage on the 
Columbia's left wing leading edge and its breached thermal protection system of 
reinforced carbon-carbon (RCC) panels. 


Despite the wing impact damage, Columbia and its crew operated on-orbit throughout the 
mission with only a few minor problems and performed successful science objectives. 


[* Details are documented in the official Columbia Accident Investigation Board (CAIB), 
Report Vol. 1, August 2003.] 
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This is the sort of simple co leu lotion that the DAT should have been performed, 
but unfortunately did not. The numerical result indicates a very high impact load 
that the wing leading edge RCC panel cannot tolerate. 


Newton's Second Law of Motion rewritten in terms of the foam debris 
projectile's momentum change: 

dv 

-r = ma = m — 

dt 


- F(dt) = m(dv) 

rVf 

— F(At) = twJ dv = m(vf - vo) 
7^0 (Volume) vo 2 


Fpeak — 


4/ 


—mv o 


Assuming that the projectile decelerated linearly over its characteristic 
length , assuming the impact force time history is a ha If -sine shape , and 
plugging all known parameter values (provided in CAIB report ), the peak 
force -> Thousands of pounds . 


Of course, an RCC panel cannot tolerate such a concentrated force and 
maintain any structural integrity -> It will break . 
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Debris Assessment Team (DAT) 

• Formed on Flight Day 6 by United Space Alliance/Boeing. Had 30+ members, 
including multiple NASA Center & contractor engineers, and Safety. Rocha was 
representing JSC Structural Engineering Division (ES) as its Shuttle Chief Engineer, 
and was also Chairman of the Space Shuttle Loads & Dynamics Panel. 


• DAT quandaries: 

— Was debris impact In-Family or Out-of-Family? [See definitions in Backup charts.] 

- So what, what did this really mean here? 

— And who owns us? [No clarification on these questions received.] 

- DAT had only three days to get "The Answer" to the Mission Evaluation Room (MER) and to the 
Mission Management Team (MMT). 

• Engineers' concerns were heightened by their interpretation of the Flight Day-2 
video (albeit blurry and projectile strike location and damage were unknown). 

- Rocha queried JSC's Thermal Design Branch (ES3) engineers. They possessed the expertise for the Orbiter thermal 
protection system for tile and reinforced carbon-carbon material. They were very concerned that the wing strike could 
be potentially catastrophic. They too became members of the DAT. 

- CAIB documents concerns expressed by the Inter-center Photo Working Group (Robert Page, Chair), Mr. Wayne Hale 
(Shuttle Program Manager for Launch Integration at KSC), Mr. Lambert Austin (Shuttle SE&I Office), and engineers 
from USA and Boeing. 

- All wanted an extra photo. (Messrs. Hale and Austin did initialize photo requests with the military POCs.) 


6 


DAT, continued 


• Drove the DAT's and these other individuals to submit urgent requests for 
definitive, extra imagery. The various requests followed different paths, but all 
were shut down by SSP (Space Shuttle Program) managers. The denial of such 
requests confounded and confused the DAT members; crazy rumors started. [Ref. 
Rocha email , Back-up page 17] 


• DAT thus became hobbled. -> No way to even initialize a meaningful and 
applicable damage-tolerance model & assessment without a clear view of actual 
damage. 

• Situation of photo-denial and no clear management direction posed a dilemma to 
the DAT and others: If Program management says, "No," or states, "not 
interested ," to a gravely urgent reguest, then what to do next? Stand down our 
concerns? Do your best but " reasonable " assumptions, but don't guarantee a bad 
answer? Is my job really finished? 
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DAT, continued 


• Despite lack of critical info, DAT proceeded to produce a highly uncertain and flawed 
analysis. Met the 3-day deadline and presented to MER and SSP on Jan. 24, 2003. 

- Empirical tools (Crater, ICE, TPS seal disruption) were extremely sensitive to inputs. Usage was far outside 
the bounds of the test data. No actual damage configuration available, thus, not anchored to reality. 

- The DAT assessment, though citing high uncertainty and cautions on the assumptions and tools used, 
indicated "no safety of flight issue." It was wrong . [There was no way to show this analysis was 
representative of actual damage.] 


• The week following the DAT presentation, Rocha and the JSC ES expert for Orbiter 
wheels/tires continued to harbor concerns centered around the possibility of an 
overheated tire exploding and catastrophically damaging the wing during Columbia's 
descent and approach to the runway. 

- Equivocal emails, which were sent to NASA Langley Research Center's Impact Dynamics Laboratory rep, JSC 
MOD mission controller, and NASA Headquarters/Brian O'Connor, caused more confusion among the 
recipients. 

- Rocha made a second attempt at extra imagery though MOD process. At Rocha's request, a Shuttle Loads 
Panel representative approached the STS-107 Ascent/Entry Flight Director and MOD reps. They in turn asked 
Shuttle management again. Again the request was denied and was considered "a dead issue." 
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Communication Breakdown, Contributing Factors 

It will probably never be known if the loss of the Columbia vehicle and its crew could have been prevented, but in hindsight some 
important contributing factors to the improper and misleading flight safety assessment emerged: 

• Ineffective and failed communication paths. 

- Confusing ownership of the issue and its assessment . Under the MER or MMT or neither? 

- Emails without management reply; emails with equivocal or unclear requests; face-to-face heated 
arguments with no follow-up action; etc 

- Lack of clear processes and reporting paths to employ— and to whom? Should DAT have submitted a 
so-called Chit to the MER, thus forcing an official and transparent response to a formal photo 
request? 

- Over-emphasis on communication protocol ("Don't email managers in high positions.") 

— DAT's final assessment did not clearly focus and emphasize the large uncertainties of the modeled 
damage when presented. 


• Curious lack of management (from low-to-high levels) to support and escort DAT requests to higher level. 
DAT seemed to be an odd ownerless entity left alone without clout to make any "requirement" for extra 
imagery. All this was contrary to NASA engineering experience, training, modeling & mentoring, and to the 
pre-flight readiness process. [CAIB cites similar lack of "intellectual curiosity" among managers.] 


• Mixed messages from management and JSC EA engineering integration organization: 

- "This foam strike is urgent, keep me informed, let me pose you questions, hurry and produce an 
analysis, but I'll neglect your requests for more data." 

- "I integrate information down, not upward." 

- Lack of a process to contact to approach highest level management in charge. 
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Communication Breakdown, Contributing Factors 

continued 


JSC Engineering's pre-flight readiness process had evaporated by STS-107 even though there were significant pre-flight issues 
(Cracked Stoody BSTRA Balls, Flow Liner cracks, SRB ETA Ring material property discrepancy and flying with negative 
margins, STS-112 ET big foam loss and strike, etc.) Launch pressure 


Weak evidence for managers to weigh. Good? ...with only minor damage on landing return? Or, so bad to be catastrophic? 
No data at all from MER, Mission Control, or crew report to resolve the issue. 


Active and energetic opposition by some individuals to a photo requests; strong resistance to taking extraordinary action; 
shouting and angry talk. Why? 


Pervasive "Prove it's unsafe first!" and "If it's that bad, there's nothing we can do about it." 


"Normalization of Deviance" belief at work: "We've had foam strikes before and we always landed okay." [Refer to Diane 
Vaughan's book, The Challenger Launch Decision] 


Absolved accountability: "If they (upper management) have accepted the risk, my job is over, right?" [My view: My role as ES 
Div. DCE and signatory to the Flight Readiness Statement did not end with a successful launch.] 


Emotional & attitude factors (anger, upset, distress, arrogance, denial,...) 

- Personalities clashing; the "Rocha filter" as a perception of overstating a problem -> Urgent concern is so weak in 
evidence, it then "drops through the crack" with no further action to investigate or resolve. 

- Examples: "I can't work with an angry person." "You're not a team player." 
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Lessons-Learned & Improvements Implemented 

in Return-to-Flight 

Mission Management Team (MMT) meets daily during a Space Shuttle mission. 

JSC Engineering Director (or designate) is a member of the MMT. Fully briefed of issues and concerns 
before the MMT commences its meeting. Also JSC EA-Director reps at the PRCB, Daily PRCB, SICB, etc. 

Establishment of the Independent Technical Authority (ITA) and the NASA Engineering Safety Council 
(NESC). [The ITA is accessible and the JSC EA-Director holds special SSP tag-ups.] 

Wealth of image assets & radar available to Shuttle SE&I and detailed high resolution images fed to the 
Debris Assessment Team (DAT). Special "focused inspections" are options available every mission. 

DAT reports results and conclusions directly and clearly to Orbiter Project Office, then to MMT, without 
undue "hurry up" pressure. 

Engineers are encouraged to speak up with concerns. Possible paths: 

- Supervisor(s) 

- Emails directly to upper management 

- Dissenting Opinions and Alternate Technical Views are welcome at meetings. Some program documents describe a 
process to do so, including an appeal to the NASA Administrator. 

- MMT anonymous forms at meetings 

- ITA and the NESC 

- Ombuds Office; National Safety Reporting System (NSRS) 


Lessons-Learned & Improvements Implemented 
in Return-to-Flight, continued 


• Repair kits (uncertified as-yet) for TPS tiles and the wing carbon panels are available every flight. 

• Physics-based, test-validated analytic tools developed expressly for damage-tolerance assessments 

• Provision for Contingency Shuttle Crew Support or ISS "safe haven" for astronauts if the orbiter is disabled 
or any damages are irreparable. [Note: It was impossible for Columbia to get to ISS.] 

• Stand-by "Launch-on-Need" Orbiter can attempt rescue of another Orbiter or retrieval of crew from the 
ISS. 

• Lessons-learned being gathered for vehicle programs other than Space Shuttle. 
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Cautions for the Future 


Uncertainty remains on repair methods and whether they can really work in combined & complex 
thermal, aerodynamic, and vibration environments. They may never get fully "certified." The work site may 
be very difficult to access via EVA or the coupled RMS/Crewperson may be dynamically unstable. 


Level of briefing and detail presented to managers depends on their individual management style. Not 
standardized. Great sensitivity right after an accident to listen to everything. Wanes as time passes. 


Not as much direct soliciting of Dissenting Opinions or offers to abet them. They are not as strongly invited 
as in the accident's immediate aftermath. Today one has to be quite assertive. 

Subtle and unconscious return of the "Prove it's unsafe" paradigm. 


Emotional interaction factors are real and still can color what should be technical, rationale discussions. 


Will Lessons Learned actually be read and implemented for future high-risk programs? 


Cautions for the Future 
-continued- 


• Beware of "Kill the (lone) messenger" mind set. Take your urgent message forward and 
upward with your informed and knowledgeable group of experts. [This worked 
beautifully for assessing the hazards posed by the hypothetical STS-400 Orbiter rescue 
mission of the STS-125 Orbiter/HST crew.] 

• "Don't overwork. Don't over-stress. Take good care of yourself, physically and mentally." 
However, these caring messages are seldom voiced by managers nowadays and seem to 
have expired. 


• Aerospace vehicle operation always presents high risk and hazards. It is managers' 
prerogative to accept risk. -> NASA Headquarters-Safety, Brian O'Connor's said: "I do 
accept risk, but I need engineers to tell me precisely what the risk is." 


• You may not be able to change the "culture" or "mindset" of a large organization or 
correct any inadequacies of process/communication, but, you, as an individual, may 
make a huge difference by your very involvement and standing up. 


• Engineers with the expertise and experience need to remain ever the vanguards of risk 
identification , its elucidation to management , and methods to reduce risk. 
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Backup Material 
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Definitions, from the CAIB Report, page 122 


• In Family: A reportable problem that was previously experienced, 
analyzed, and understood. Out of limits performance or discrepancies that 
have been previously experienced may be considered as in-family when 
specifically approved by the Space Shuttle Program or design project. 

• Out of Family: Operation or performance outside the expected 
performance range for a given parameter or which has not previously 
been experienced. 

• Accepted Risk: The threat associated with a specific circumstance is 
known and understood, cannot be completely eliminated, and the 
circumstance(s) producing that threat is considered unlikely to reoccur. 
Hence, the circumstance is fully known and is considered a tolerable 
threat to the conduct of a Shuttle mission. 

• No Safety-of-Flight-lssue: The threat associated with a specific 
circumstance is known and understood and does not pose a threat to the 
crew and/or vehicle. 
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Excerpt from Rocha's email requesting extra imagery. Sent to JSC Engineering 
Directorate managers during STS-107 mission in progress, Jan. 23, 2003, 4:41 PM. 

[Refer to CAIB report, pages 151 - 152] 


"The meeting participants ( Boeing , USA , NASA ES2 and ES3, KSC) all agreed we will always 
have big uncertainties in any transport/trajectory analyses and applicability/extrapolation of 
the old Arc-Jet test data until we get definitive, better, clearer photos of the wing and body 
underside. Without better images it will be very difficult to even bound the problem and 
initialize thermal, trajectory, and structural analyses. Their answers may have a wide spread 
ranging from acceptable to not-acceptable to horrible, and no way to reduce uncertainty. Thus, 
giving MOD options for entry will be very difficult. 


Can we petition (beg) for outside agency assistance? We are asking for Frank Benz with Ralph Roe or Ron 
Dittemore to ask for such. Some of the old timers here remember we got such help in the early 1980's when we had 
missing tile concerns. 

Despite some nay-sayers, there are some options for the team to talk about: On-orbit thermal conditioning for the 
major structure (but is in contradiction with tire pressure temp, cold limits), limiting high cross-range de-orbit 
entries, constraining right or left had turns during the Heading Alignment Circle (only if there is struc. damage to 
the RCC panels to the extent it affects flight control. " 

Rodney Rocha 

Structural Engineering Division (ES-SED) 

• ES Div. Chief Engineer (Space Shuttle DCE) 

• Chair, Space Shuttle Loads & Dynamics Panel 

Mail Code ES2 


17 


JSC Organizations as of February 2003 


Space Shuttle Program Office 

• Director (R. Dittemore) 

• Deputy Director (L. Ham) 

• Shuttle SE&I (systems engineering & integration; L. 
Austin) 

• Orbiter Vehicle Engineering (R. Roe) 

• Mission Evaluation Room (MER; D. McCormack) 


JSC Mission Operations Directorate 

• Mission Control Room 

• Flight Directors (L. Cain, others) 


JSC Engineering Directorate 

• Director (F. Benz) 

• Deputy (L. Hansen) 

• EA4 - Engineering Integration Office (P. 

Shack, others) 

• MER support to Orbiter 

• ES-Struc. Engr. Div. (I. Verinder, D. Drewry, R. 
Rocha, others; ES3- Thermal Branch) 


18 





Interactive Discussion with Audience 
What would you do? 


In the Columbia post-accident Return-to-Flight period, there were significant improvements to the pre-flight and in-flight 
communication processes, and to empower engineers who have flight safety concerns and their need to express them. 

Despite these positive changes, what more can be done? 

• What other improvements should be implemented? 

• How are flight safety responsibilities and accountabilities different between an organization and you as an individual? If a 
manager states, "I accept the risk," but you are still harboring concerns, then what? How and when do you know to quit or 
stand-down your efforts? 

• Assuming a grave issue or hazard is presenting a concern to some, how can you handle or manage a highly emotionally- 
charged person— whether in yourself or your colleagues or from an authority figure? 

• Assuming you are assigned to a special assessment team, how would you manage an issue based on "weak" evidence, but 
for which the consequences of failure are catastrophic? 

• Are emails an effective means to convey grave concerns? 

• How would you encourage and seek out dissenting opinions in your team or project? What if you or someone else is all 
alone in holding a contrary view? 


How to detect and then prevent backsliding to old mindsets? How much push back can an individual do? 
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